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(C) As analysts, you know that all data sets and intelligence needs 
are not created equal; consequently there is no "one-methodology- 
fits-all" approach to apply to SIGINT problems. It's very 
challenging to know when to apply different methodologies to 
achieve the results we need. Social Network Analysis (SNA) and 
Pattern Analysis are analytic methodologies that have been 
successful against counterterrorism targets and may likely prove 
successful in pursuing other targets. 

(C) Social Network Analysis 

(C) As a practical example, when you want to influence your boss's 
decision on an important matter, how and through whom do you 
relay your point of view? Based on your own SNA of the workplace, 
you will contact the person in the best position to influence your 
boss and you'll communicate via the mode that you consider most 
effective. Your target works that way too, and the better you 
understand the structure of the social networks, the better your 
chances of finding weaknesses that can be leveraged for SIGINT 
advantage. 

(S//SI) SNA can help you identify people who, although they may 
not be significant in the "official" leadership hierarchy, have 
influential personal ties to people in high places. This is possible 
because SNA consolidates large volumes of current SIGINT 
reporting to provide a bird's eye view of a network and how it is 
connected. SNA conducted against two years' worth of SIGINT data 
on terrorist Abu Zubaida and his network showed a highly 
interconnected group of 300 terrorists who were still largely 
connected even after Zubaida was arrested and removed from the 
picture. This stands in sharp contrast to open source "conventional 
wisdom" which holds that terrorist organizations are structured 
into isolated cells, where most of the people have little knowledge 
of or contact with others. 

(C) Pattern Analysis 

(S//SI) How can NSA help find the al-Qa'ida terrorists who may 
soon carry out an attack in the U.S., without knowing their names 
or anything else about them? One answer is the Terrorist Threat 
Pattern Analysis Model developed by the Counterterrorism 
Strategic Intelligence and Operations Center (SIOC). CT SIOC 
thoroughly analyzed the calamitous events of 11 September 2001 
(and the events leading up to it) to try to stop such an event from 
occurring again. That analysis revealed that most of the September 
11th hijackers were not known to intelligence services throughout 
the world and, therefore, did not draw the attention of those 
services. Without knowing in advance that these people were 
terrorists, and with no names, passport numbers, or other 
identifying information, the Intelligence Community could not track 
them. Pattern analysis helps us defeat such a foe. By determining 
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the way in which the terrorists traveled, received finances, 
obtained identifications, and carried out operational activities, it 
was possible to develop a model of their operational patterns. By 
converting that model into algorithms and running those algorithms 
against SIGINT, NSA hopes to identify potential terrorists base on 
their patterns of activity before they are able to carry out their 
attacks. 

(U) Conclusion 

(C) So, if you don't know exactly who your target is, but he 
repeats his methods of operations, pattern analysis may help you 
find him. Likewise, if you want to uncover people or ascertain their 
significance and role in your target network, you might want to try 
SNA. Hopefully, we've given you some food for thought so you can 
begin to look at your target in a different way and consider 
employing these methodologies to your SIGINT advantage. The CT 
SIOC stands ready to provide more specifics on Pattern Analysis, 
and the Social Network Analysis Workcenter ("go sna") is poised to 
consider your target for study. 


"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet 
without the consent of S0121 (DL sid comms V 
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